AIKIDO-2026-10482
better-auth is vulnerable to Incorrect Authorization
24
Low Risk
This Affects:
better-authTL;DR
After a backup code was consumed, the plugin rewrote the remaining codes using the built-in encryption path even when the deployment configured plain text or a custom storeBackupCodes strategy. Subsequent verification could then fail for legitimate users, effectively breaking second-factor recovery. The fix re-saves remaining codes with the same strategy the application configured.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
better-auth is vulnerable to Incorrect Authorization in versions 1.4.0 - 1.6.2.
How to fix this
Upgrade the better-auth library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant